> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vortexiq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Top 10 Slow Searches, Elasticsearch

> Top 10 Slow Searches for Elasticsearch clusters. Tracked live in Vortex IQ Nerve Centre. How to read it, why it matters, and how to act on it.

**Card class:** [Non-Hero](/nerve-centre/overview#card-classes-explained)  •  **Category:** [Performance](/nerve-centre/connectors#connectors-by-type)

## At a glance

> The ten slowest searches the cluster has logged over the last 24 hours, broken down by row: each entry shows the query, the index it hit, how long it took (`took`), and the shard it was slow on. This is the diagnostic detail behind the headline performance cards. When [Slow-Query Rate %](/nerve-centre/kpi-cards/elasticsearch/slow-query-rate) or [Search Latency p99 (ms)](/nerve-centre/kpi-cards/elasticsearch/search-latency-p99-ms) climbs, this card names the exact queries to optimise.

## What it tracks

The card reads the search slowlog over a trailing 24-hour window and surfaces the ten entries with the highest `took` durations, sorted slowest first. Each row carries the query source, target index, duration and the shard that breached the slowlog threshold, so a platform team can move straight from "search is slow" to "this aggregation on the `products` index is the culprit". Typical offenders are deep pagination (`from` + `size` running into the thousands), large or nested aggregations, leading-wildcard queries, and scripted sorts. Because the window is 24 hours, the card captures overnight batch queries and one-off pathological searches that a short-window percentile card would miss. It has no alert threshold of its own; it is a drill-down companion to the alerting performance cards.

## Reconciling against the source

Cross-check against Elasticsearch's own search slowlog file (`<cluster>_index_search_slowlog.json`), which records every slow entry with `took`, the query source and the shard. Confirm the slowlog threshold via `GET /<index>/_settings?include_defaults=true&filter_path=**.slowlog`, and use `GET /<index>/_search?profile=true` to re-run a suspect query and see its phase-by-phase timing. In managed services the same slowlog is shipped to Elastic Cloud logging, AWS OpenSearch/Elasticsearch Service CloudWatch Logs, or the Bonsai dashboard.

***

### Tracked live in Vortex IQ Nerve Centre

*Top 10 Slow Searches* is one of hundreds of KPI pulses Vortex IQ tracks across Elasticsearch and 70+ other ecommerce connectors. Nerve Centre runs the detection layer; Vortex Mind investigates the cause when something moves; Ask Viq lets you interrogate any number in plain English.

[Start for free](https://app.vortexiq.ai/login) or [book a demo](https://www.vortexiq.ai/contact-us) to see this metric running on your own data.
